What it is
The European Securities and Markets Authority (ESMA) is the EU’s financial markets regulator and supervisor. Established under Regulation (EU) No 1095/2010, it began operating on 1 January 2011, replacing the Committee of European Securities Regulators in the supervisory overhaul that followed the 2008 financial crisis. Headquartered in Paris, ESMA is one of the three European Supervisory Authorities — alongside the European Banking Authority (EBA) and the insurance authority EIOPA — within the European System of Financial Supervision. Its mission is to enhance investor protection and promote stable, well-functioning financial markets: it builds the EU’s single rulebook for securities markets and works to ensure national competent authorities (NCAs) apply it consistently. Since the Markets in Crypto-Assets Regulation (MiCA) took effect, ESMA has become the EU-level coordinator for crypto-asset markets, while the EBA runs the parallel workstream for stablecoin issuers.
Crypto framework and stance
MiCA entered into force on 29 June 2023 and applied in stages: the stablecoin titles for asset-referenced and e-money tokens from 30 June 2024, and the authorisation regime for crypto-asset service providers (CASPs) from 30 December 2024, with transitional “grandfathering” arrangements that ended on 1 July 2026. Under the regulation, ESMA develops technical standards and guidelines in close cooperation with the EBA, EIOPA and the ECB, and it publishes the EU-wide interim MiCA register — five weekly-updated lists covering crypto-asset white papers, ART issuers, EMT issuers, authorised CASPs, and non-compliant entities offering crypto services without authorisation. White papers must be filed in machine-readable iXBRL format, a requirement that applied from 23 December 2025. CASPs are authorised and supervised day to day by national regulators, with ESMA driving supervisory convergence through peer reviews and public statements. That balance may soon shift: in December 2025 the European Commission’s Market Integration and Supervision Package proposed transferring direct supervision of all CASPs from national authorities to ESMA — a move widely described as giving the authority SEC-like powers — and ESMA publicly welcomed the proposal.
Notable actions
ESMA’s recent crypto record is dense. In January 2025 it published a joint report with the EBA on crypto-asset market developments, finding DeFi remained niche — around 4% of global crypto market value locked in protocols — and flagging leverage, information asymmetries and collateral re-use as risks, while identifying no current threat to financial stability. In June 2025 it recommended making the DLT Pilot Regime for tokenized market infrastructure permanent, with adjustable thresholds and broader eligible assets, despite limited early uptake. July 2025 brought three moves in quick succession: a fast-track peer review of Malta’s MFSA that found a CASP authorisation “should have been more thorough” and set out expectations for all national regulators; final MiCA guidelines on the knowledge and competence of staff giving crypto advice; and a public statement warning of the “halo effect” when authorised CASPs sell unregulated products alongside regulated ones. In October 2025 the three ESAs jointly issued a revised consumer warning on crypto-assets. And in early July 2026, days after the transition period closed, ESMA’s register update added 37 newly authorised CASPs — including Standard Chartered, licensed via its Luxembourg subsidiary on 29 June 2026, and FalconX — bringing the register to roughly 280 entities.
Key figures
ESMA’s chair, Verena Ross, has led the authority since 1 November 2021, after a decade as its executive director. Under her tenure ESMA stood up the MiCA supervisory-convergence machinery — the interim register, the peer-review programme, and the guideline pipeline — and positioned the authority to absorb the direct CASP supervision the Commission proposed in late 2025. In December 2025 ESMA announced that Ross will not seek a second mandate and will step down when her term ends on 31 October 2026; the selection process for her successor began in February 2026, with a shortlist published in May 2026.
What it means for users and builders
For exchanges and brokers, one MiCA licence now passports across the EU/EEA, and the major platforms took that route through national regulators: Bitpanda via Germany’s BaFin in January 2025, OKX and Crypto.com via Malta’s MFSA the same month, Bybit via Austria’s FMA in May 2025, Coinbase via Luxembourg’s CSSF in June 2025, and Kraken via the Central Bank of Ireland in June 2025. Since 1 July 2026, firms not in ESMA’s register may no longer lawfully serve EU clients — making the register the practical map of who can operate in Europe, and its non-compliant-entities list a useful red-flag check. For users, ESMA’s halo-effect statement is the key caveat: MiCA’s protections stop at regulated services, so staking, lending or other unregulated products sold by a licensed CASP carry no equivalent safeguards. For builders, the staff knowledge-and-competence guidelines raise the bar for customer-facing crypto services, and the prospect of direct ESMA supervision means EU-facing compliance is likely to become more centralized, not less.
Outlook
The defining question for 2026–27 is whether ESMA becomes the EU’s single crypto supervisor. The Commission’s Market Integration and Supervision Package is now with the co-legislators, and its CASP-supervision transfer would fundamentally reshape the national-regulator model MiCA launched with. In parallel, the interim register is due to be integrated into ESMA’s own IT systems in mid-2026, the DLT Pilot Regime may be made permanent along the lines ESMA recommended, and a new chair takes over from November 2026. Expect continued peer-review pressure on national authorisation quality in the meantime — Malta was the first test case, and ESMA has signalled convergence will be enforced, not assumed.